COVID Infection Survey
The report for the COVID infection survey beta assessment on the 09 June 2022
Service Standard assessment report
COVID Infection Survey
| From: | Central Digital & Data Office (CDDO) |
| Assessment date: | 09/06/2022 |
| Stage: | Beta |
| Result: | Met |
| Service provider: | Office for National Statistics |
Service description
The COVID Infection Survey has been running since April 2020 using a Study Worker led face-to-face model. The transitioned service will allow survey participants to opt in to a digital-first survey and complete their data collection either digitally via a browser-based questionnaire, or over the phone, on a monthly basis, with around 70k questionnaires to be completed weekly via all channels. This service sits within a wider biosample collection process, where participants are expected to conduct swab and blood samples remotely, returning via post or courier to the logistics chain. Test results and data flows will continue using existing channels.
Service users
Study participants – 4 key groups outlined below:
- Digital participants
- Non-digital participants
- Physically mobile participants
- Non-physically mobile participants
Other participants with different needs are also being considered and tested as part of the Alpha and Beta phase, such as:
- Hearing impaired participants,
- Visually impaired participants,
- Participants living in remote areas,
- English as a second language,
- Participants with a cognitive impairment/neurodiversity,
- Participants with limited availability.
Covering advisory note;
This report is written on the basis that this service is tactical - it is due to end in March 2023. At this time the service is planned to stay in public beta until it is decommissioned and there is no plan to assess at Live. However, the advice and guidance provided in this report could be used for any Covid Infection Survey requirements which may be needed in the future. If the service continues on after March 2023, then the service should be assessed at Live at that time.
1. Understand users and their needs
Decision
The service did not meet point 1 of the Standard.
What the team has done well
The panel was impressed that:
- the team have identified a number of key user groups (including those that complete the questionnaire digitally and are able to get to a post box, and those who are not able and require a courier. Those that complete the questionnaire over the telephone and are able to get to a post box, and those who are not able and require a courier)
- the team have utilised quantitative research to understand and react to user behaviour. During assessment, the user researcher clearly explained how they have learnt from management information and service analytics and how they’ve used this information to recommend iterative improvements. This team’s work is a very strong example of how to use quantitative data and performance analytics to identify service issues and improve them, and the panel would encourage the team to share their approach widely (perhaps through blog posts or cross government communities)
- user research is evidently a team sport - alongside the user researcher, it is clear that the multidisciplinary team are engaged in, and understand, the outcomes of user research. On top of this, the programme has a dedicated research and development team in place to support user-centred decision making and improve user experience on an ongoing basis. This research and resource will continue throughout the lifecycle of CIS digital and will enable the CIS (and their similar digital ONS services) to continually improve for the benefit of end users
What the team needs to explore
Before their next assessment, the team needs to:
- iterate their user needs and personas to be more behavioural and motivation specific. At the moment, the team’s personas are largely assumption based and do not explain the behaviours, motivations and holistic needs of each user. Similarly, some of the team’s user needs are solution specific (for example, I need to send my sample to the lab) as opposed to referring to the driving factors that lead users to take part in the survey. The team were able to clearly articulate their users’ behaviours verbally to the panel (some users feel completing the survey is their public duty, others complete the survey to receive the incentive) and should use this knowledge and understanding to iterate their user needs accordingly
- conduct research, in particular usability testing, with users with access needs. Although the team have conducted research with friends and family members with access needs and have received a DAC report, it is crucial that they test improvements (as recommended by DAC) with users with access needs to determine whether their iterations are fit for purpose, and to build a picture of these users. The team should consider using a recruitment agency if they’re unable to self-recruit users with access needs, and the User Research assessor can assist them with this process if needed. This recommendation also relates to service standard points 4 and 5
- conduct research with potential service users as opposed to just existing service users. The current approach to research centres around identifying issues with the existing service and suggesting improvements based on these findings. Although this is a crucial aspect of Beta research, the team must also remain mindful that their iterations must be tested with new users (ideally those that are unfamiliar with the service) so that they can objectively assess the impact of their iterations and ensure the service is intuitive
2. Solve a whole problem for users
Decision
The service met point 2 of the Standard.
What the team has done well
The panel was impressed that:
- they’ve identified their constraints for the service and clearly presented them
- they have demonstrated how they are solving the problem for users
- they have reduced the length of the questionnaire as much as possible and are aware that the questionnaire must be as simple as possible
What the team needs to explore
Before their next assessment, the team needs to:
- continue reviewing the constraints and where possible reduce the constraints. This service has had to be quickly turned around with limited resources and the team has done a good job with producing a service that solves most of the challenges. However, the digital service still needs to be worked on to improve content and design patterns and components throughout
3. Provide a joined-up experience across all channels
Decision
The service met point 3 of the Standard.
What the team has done well
The panel was impressed that:
- the team have mapped out all of the steps involved in the journey and have identified key areas that they want to transform or adapt not trying to do too much
- the front-line operations staff seem involved in the process and have answered user enquiries where needed, the phone journey is mentioned on the opt in journey and throughout the service
What the team needs to explore
Before their next assessment, the team needs to:
- show how a new user would be onboarded and how they would discover this service. At the moment the service is for existing participants only so the team have focused on this journey but have later plans to allow new participants to join the study
4. Make the service simple to use
Decision
The service did not meet point 4 of the Standard.
What the team has done well
The panel was impressed that:
- the digital service does provide a more convenient and cost-effective way to collect data allowing users to submit data when it is best for them
- the documentation provided to opt into the process seems well thought out, especially the storyboard that is provided. It provides clear diagrams and steps instructing the user what to do next
- the documentation provided on how to take a blood sample is clear with illustrations provided as part of the pack
What the team needs to explore
Before their next assessment, the team needs to:
- improve content throughout the service, in particular the error validation messages. Most of the error validation messages were not clear and did not provide users guidance on what to do to correct their mistakes. It is strongly recommended that the service gets an independent content audit done in the near-future and improvements are made before the service goes into BAU
- review use of design patterns and components throughout the service. The team have acknowledged that some of the components and the ways that questions are asked are not ideal, such as asking for date of birth and when entering a date. The service needs to address all of these issues as well as reviewing other factors like font sizing and the HTML structure throughout. When compared to the ONS design system some components have incorrect font sizing or another example is incorrect button states like focus or hover
5. Make sure everyone can use the service
Decision
The service does not meet point 5 of the Standard.
What the team has done well
The panel was impressed that:
- there have been some iterations of the service since going live in private beta. Where they have done iterations, such as the issue with participants not being able to access the service, they made quick improvements to the service
- the team have built a good backlog of work based on the online questionnaire and the team seem to have plans to address feedback that has been raised
- support guidance for those who have assisted digital needs are given details on who to contact on the opt in letter
What the team needs to explore
Before their next assessment, the team needs to:
- be fully WCAG AA compliant, addressing all points in the DAC report and getting the follow up audit report. Any further points in the new report must also be addressed if the service is still not AA compliant
- review the use of Javascript and whether it is needed to support the service. Javascript reliant services are not best practice when building services but instead build services in a progressive enhancement way. More information can be found here: https://www.gov.uk/service-manual/technology/using-progressive-enhancement
6. Have a multidisciplinary team
Decision
The service met point 6 of the Standard.
What the team has done well
The panel was impressed that:
- the team have worked with and managed an external supplier to build the service quickly, ensuring that data can be used to benefit citizens by informing them if they have had Covid and benefited society by being able to show trends and infection data
- the team have filled skills gaps, when necessary, from other teams within ONS to ensure the service can continue from discovery through to the end of private beta
- the team can escalate concerns to senior stakeholders quickly and effectively with short resolutions timescales when needed
What the team needs to explore
While in public beta the team needs to:
- bring in more permanent staff and ensure that handover to an ONS team takes place, if the service were to continue. However, the panel’s understanding is that this service is a tactical solution which will not continue
7. Use agile ways of working
Decision
The service met point 7 of the Standard.
What the team has done well
The panel was impressed that:
- the team were honest about the setup of agile ways of working and focused, in the discovery and alpha phases, on delivery of user research and prototyping rather than strictly following agile ceremonies
- the team demonstrated sprint frequency, backlog practices and retrospectives in private beta
- the team showed iteration of the service based on user feedback
What the team needs to explore
While in public beta the team needs to:
- ensure any disagreements are added to retrospectives to ensure lessons are learned
8. Iterate and improve frequently
Decision
The service met point 8 of the Standard.
What the team has done well
The panel was impressed that:
- the team clearly evidenced an iteration and improvement cycle based on feedback from users
- the service team can discuss needs with the supplier daily and receives frequent updates and improvements
What the team needs to explore
While in public beta, the team needs to:
- understand the difference between wants and needs
- focus the design iteration on higher level user needs
- continue to iterate the service until it is decommissioned in March 2023
- consider contingency plans if there is an urgent need for a similar survey after March 2023
9. Create a secure service which protects users’ privacy
Decision
The service met point 9 of the Standard.
What the team has done well
The panel was impressed that:
- the team have demonstrated security considerations
- the team have weekly meetings with ONS security
- PII data is collected in a secure way redacting data
- data is stored in the IQVIA data platform which is imported from the Salesforce proprietary solution. Utilizing RESTful services between application and https API -and OAUTH2 for services from Salesforce. Risky data held in the Salesforce enclave and redacted to other subnetworks
- test results sent via NHS Business Services Authority (NHSBSA) encryption
- Security team in ONS have reviewed the findings including IQVIA’s risk assessment and policies and procedures
- IQVIA’s data platform is managed via its proprietary Information Security Framework
- Cyberis carried out the penetration testing; they appear on the CREST list of suppliers
- penetration testing with Cyberis has been conducted with reports; for online portal (Experience) using the Salesforce back-end, with both authenticated and unauthenticated access against security standards
- the team have tested against the online portal and salesforce backend (Authenticated and unauthenticated accounts to access risk.)
- tests that have been carried out included DPIA “Brute Force Attacks and denial of service
- met the security requirements of ONS, fair warning monitoring on IQVIA’s system
- cookies are listed on policies currently in place with details on how long they are to persist
- adherence to the General Data Protection regulation (GDPR); Data is kept in the UK within the Salesforce cloud
- access is monitored using Imprivata’s proprietary solution MFA, identity
What the team needs to explore
Before their next assessment, the team needs to:
- moderate security findings uncovered during the PEN testing and are currently being mitigated with ONS and managing through the backlog
10. Define what success looks like and publish performance data
Decision
The service met point 10 of the Standard.
What the team has done well
The panel was impressed that:
- the development of analytics and measures is well organised, iterative and represents different parts of the user journey and routes to the service (e.g. telephone and digital). The visualisation of these measures are thorough and a dashboard has been created
- it was clear that analytics and quantitative data is shared and used throughout the service development, for example in weekly reports with stakeholders
What the team needs to explore
Before their next assessment, the team needs to:
- ensure that they publish KPI data on data.gov.uk (a date in the future has been scheduled for this)
- consider auditing the main dashboard to check that it complies with best practice for accessibility and visualisation
11. Choose the right tools and technology
Decision
The service met point 11 of the Standard.
What the team has done well
The panel was impressed that:
- Cloud technology first underpinned this service technology
- they’ve adhered to Open standards, e.g. WCAG 2.1
-
API technical and data standards (HTTPs & RESTful)
- the service team conducted a review to leverage the existing architecture where possible, not re-platforming the solutions
What the team needs to explore
- Before their next assessment, the team needs to:
- visit the government purchasing strategy for evidence of fair open purchase of technology and cost
12. Make new source code open
Decision
The service met point 12 of the Standard.
What the team has done well
The panel was impressed that:
- the metadata for the CIS service is stored in GitHub. (Otherwise, the solution with Salesforce is proprietary)
What the team needs to explore
Before their next assessment, the team needs to:
- explore the possibility of the utilisation of the <gov.uk Forms> (Low-code solutions were the mode for building forms in the CIS service.)
13. Use and contribute to open standards, common components and patterns
Decision
The service met point 13 of the Standard.
What the team has done well
The panel was impressed with:
- Identity assurance
- Networking
- Risk Management
- Security -Cloud security
-
Common standards were adhered to including:
- Accessibility
- API
What the team needs to explore
Before their next assessment, the team needs to:
- explore other standards: such as- refer to the Government Transformation Strategy with a view to the transformation from the manual field survey mode of data collection to the digital service
14. Operate a reliable service
Decision
The service met point 14 of the Standard.
What the team has done well
The panel was impressed that:
- IQVIA holds the data securely sharing via sub-nets
- with planned SLA (service level agreements)
- short windows of downtime, with publication prior and managed by the support team. With unplanned downtime -Further outages supported by agreed BIAs BCP and KPI
What the team needs to explore
Before their next assessment, the team needs to:
- carry out quality assurance testing regularly